7 ms·

There is one specific step that everyone can take to eliminate approx 90-95%+ of drive-by-zero-day-exploits without really impacting your web browsing habits th

There is one specific step that everyone can take to eliminate approx 90-95%+ of drive-by-zero-day-exploits without really impacting your web browsing habits that much: Disable Plugins on your primary browser. Whether that be Opera/Safari/IE/Firefox - just disable the plugins. Then, all of these Java 0days, PDF 0days, Flash 0days won't impact you. Keep a backup browser, that is not your primary, and use that for your SSL VPN (frequently Java), or Crappy Enteprise Apps like timesheets and Remedy (frequently Flash). Yes, browsers have 0days as well, but they occur much less frequently (approximately 1/10th) than plugin vulnerabilities, and get repaired much more quickly. For the really security conscious, of course, browsing from a separated/virtualized thin-client is even better, particularly if you can live with the hassle of refreshing your cookies every so often after a reset.

jakub_g 14y ago
Having a second browser brings also the advantage of not being signed in to Gmail constantly while googling things etc.
danso 14y ago
This is good advice, but I'd amend it to say this: For your Facebook-viewing browser, disable all plugins. For the most part, you won't be viewing anything that can't be viewed without HTML5 and Javascript anyway. The added advantage to sequestering FB activity to a browser is that you won't be tracked by sites that use FB widgets. Another added advantage of putting FB in its own browser, and YMMV, but it's easier to prevent impulsively checking FB in the middle of your normal work-related internet browsing, as it requires opening a new browser to do so.
- mahyarm 14y ago
  You start running out of browsers quickly, and seperate browser users gets tedious fast. I really wish there was easy same browser sandboxing that can save cookies and so on. Double click the gmail icon, and gmail comes up in a browser user devoted to just gmail, and shows up as a separate process and separate app. All of the 'make a webpage an app' apps that I've tried still share browser state amongst the main browser user.
  - bmuon 14y ago
    You can create profiles in Firefox and run them all at the same time by creating links like "firefox.exe -p ProfileName --no-remote". Now that there's a Firefox Marketplace you can even have full window webapps in their own little sandboxes.
  - jewel 14y ago
    This is easy to do with chrome. I have many different profiles, all of which are completely separate. Just launch with the --user-data-dir argument: #!/bin/bash exec chromium-browser --user-data-dir=/home/jewel/.profiles/facebook -app=https://facebook.com
    - stephengillie 14y ago
      Does that both specify the custom profile location, and also launch the FB app? I'm looking at this, trying to think of how to do the equivalent in Windows.
      - jewel 14y ago
        It launches it in app mode (no tabs, no URL bar). I'm not sure if that's the same thing as launching the FB app. In windows you copy the chrome shortcut and then edit the shortcut to add the command-line arguments. Then you add the shortcut to your launcher bar. Alternatively, you could create a batch file for each site that you want to isolate somewhere in PATH and launch it from the Start -> Run menu. In other words, you'd press the start key, then type "facebook", then press enter. (Please correct me if my instructions are incorrect, I haven't used windows regularly for a long time.)
- stephengillie 14y ago
  I've been running Chrome (on Windows) with adblock, https everywhere, and ghostery. With the adblocking HOSTS file. And javascript, flash, and java are disabled unless whitelisted. Also each web service has a different 30+ char random password, stored in a password manager. I have 2 problems: -My gaming friends have pulled me into Farmville, which won't run on my above configuration - it crashes when trying to post to my wall. I've began using vanilla Firefox for these games only. (Yes, I told them of the evils of Zynga, they don't care so long as the game is fun) -My friends laugh at me and call me paranoid. I don't have a workaround for this.
yareally 14y ago
One of the unique features of Opera that other browsers should add is ability whitelist/blacklist most annoyances and vulnerability points for a website. I usually default to everything off and whitelist as I go. - Kill 3rd party cookies + remove all cookies on browser close - No plugins enabled (and permanently disable all unneeded ones like Java). Plugins can be reenabled per site. - kill javascript on really bad sites that abuse it and work without it - Use private tabs and windows for shady sites - kill animated gifs and html5 video autoplay on sites that abuse them Since Opera has a built in way to whitelist sites for each of the above items (or blacklist depending on how you do it), I add trusted sites back with plugins on demand and save cookies for a few sites where not having them will be annoying (banks, etc).

jakub_g 14y ago

Having a second browser brings also the advantage of not being signed in to Gmail constantly while googling things etc.

danso 14y ago

This is good advice, but I'd amend it to say this: For your Facebook-viewing browser, disable all plugins. For the most part, you won't be viewing anything that can't be viewed without HTML5 and Javascript anyway. The added advantage to sequestering FB activity to a browser is that you won't be tracked by sites that use FB widgets. Another added advantage of putting FB in its own browser, and YMMV, but it's easier to prevent impulsively checking FB in the middle of your normal work-related internet browsing, as it requires opening a new browser to do so.

mahyarm 14y ago
You start running out of browsers quickly, and seperate browser users gets tedious fast. I really wish there was easy same browser sandboxing that can save cookies and so on. Double click the gmail icon, and gmail comes up in a browser user devoted to just gmail, and shows up as a separate process and separate app. All of the 'make a webpage an app' apps that I've tried still share browser state amongst the main browser user.
- bmuon 14y ago
  You can create profiles in Firefox and run them all at the same time by creating links like "firefox.exe -p ProfileName --no-remote". Now that there's a Firefox Marketplace you can even have full window webapps in their own little sandboxes.
- jewel 14y ago
  This is easy to do with chrome. I have many different profiles, all of which are completely separate. Just launch with the --user-data-dir argument: #!/bin/bash exec chromium-browser --user-data-dir=/home/jewel/.profiles/facebook -app=https://facebook.com
  - stephengillie 14y ago
    Does that both specify the custom profile location, and also launch the FB app? I'm looking at this, trying to think of how to do the equivalent in Windows.
    - jewel 14y ago
      It launches it in app mode (no tabs, no URL bar). I'm not sure if that's the same thing as launching the FB app. In windows you copy the chrome shortcut and then edit the shortcut to add the command-line arguments. Then you add the shortcut to your launcher bar. Alternatively, you could create a batch file for each site that you want to isolate somewhere in PATH and launch it from the Start -> Run menu. In other words, you'd press the start key, then type "facebook", then press enter. (Please correct me if my instructions are incorrect, I haven't used windows regularly for a long time.)
stephengillie 14y ago
I've been running Chrome (on Windows) with adblock, https everywhere, and ghostery. With the adblocking HOSTS file. And javascript, flash, and java are disabled unless whitelisted. Also each web service has a different 30+ char random password, stored in a password manager. I have 2 problems: -My gaming friends have pulled me into Farmville, which won't run on my above configuration - it crashes when trying to post to my wall. I've began using vanilla Firefox for these games only. (Yes, I told them of the evils of Zynga, they don't care so long as the game is fun) -My friends laugh at me and call me paranoid. I don't have a workaround for this.

yareally 14y ago

One of the unique features of Opera that other browsers should add is ability whitelist/blacklist most annoyances and vulnerability points for a website. I usually default to everything off and whitelist as I go. - Kill 3rd party cookies + remove all cookies on browser close - No plugins enabled (and permanently disable all unneeded ones like Java). Plugins can be reenabled per site. - kill javascript on really bad sites that abuse it and work without it - Use private tabs and windows for shady sites - kill animated gifs and html5 video autoplay on sites that abuse them Since Opera has a built in way to whitelist sites for each of the above items (or blacklist depending on how you do it), I add trusted sites back with plugins on demand and save cookies for a few sites where not having them will be annoying (banks, etc).